snort3 - official rules fail with ERROR: <<rulesfile>>:<<line>> unknown rule keyword: pcre.
Open
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 4.6k
- Forks
- 4k
- Avg merge
- 3d 12h
- Merged PRs (30d)
- 134
Description
Issue template (remove lines from top till here)
Maintainer: @flyn-org
Environment: ARM64, Bananapi BPI-R4, OpenWrt SNAPSHOT (r27913-a2aabc9a7a)
Description:
When trying to start snort3, thousands of rules fail to load with ERROR: <rulesfile>:<line no.> unknown rule keyword: pcre.
snort 3, 3.1.84.0-r4
,,_ -*> Snort++ <*-
o" )~ Version 3.1.84.0
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2024 Cisco and/or its affiliates. All rights reserved.
Copyright (C) 1998-2013 Sourcefire, Inc., et al.
Using DAQ version 3.0.15
Using LuaJIT version 2.1.0-beta3
Using OpenSSL 3.0.15 3 Sep 2024
Using libpcap version 1.10.5 (with TPACKET_V3)
Using PCRE version 10.42 2022-12-11
Using ZLIB version 1.3.1
Using LZMA version 5.6.2
Reproduce:
- Install snort
- Setup config with oinkcode
- Download official ruleset with snort-rules
- Restart snort
More info:
root@defiant:/tmp/snort.d/rules# ldd /usr/bin/snort
/lib/ld-musl-aarch64.so.1 (0x7f80856000)
libtirpc.so.3 => /usr/lib/libtirpc.so.3 (0x7f80815000)
libdaq.so.3 => /usr/lib/libdaq.so.3 (0x7f807f4000)
libdnet.so.1 => /usr/lib/libdnet.so.1 (0x7f807d3000)
libhwloc.so.15 => /usr/lib/libhwloc.so.15 (0x7f80772000)
libluajit-5.1.so.2 => /usr/lib/libluajit-5.1.so.2 (0x7f806f1000)
libcrypto.so.3 => /usr/lib/libcrypto.so.3 (0x7f8031c000)
libpcap.so.1 => /usr/lib/libpcap.so.1 (0x7f802bb000)
libpcre2-8.so.0 => /usr/lib/libpcre2-8.so.0 (0x7f8025a000)
libz.so.1 => /usr/lib/libz.so.1 (0x7f80229000)
libatomic.so.1 => /lib/libatomic.so.1 (0x7f80207000)
liblzma.so.5 => /usr/lib/liblzma.so.5 (0x7f801d6000)
libuuid.so.1 => /usr/lib/libuuid.so.1 (0x7f801b5000)
libtcmalloc.so.4 => /usr/lib/libtcmalloc.so.4 (0x7f7ffa2000)
libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x7f7fd9d000)
libgcc_s.so.1 => /lib/libgcc_s.so.1 (0x7f7fd6c000)
libc.so => /lib/ld-musl-aarch64.so.1 (0x7f80856000)
libpciaccess.so.0 => /usr/lib/libpciaccess.so.0 (0x7f7fd4b000)
libunwind.so.8 => /usr/lib/libunwind.so.8 (0x7f7fd09000)
Logs not included because it's 12114 errors (463 warnings).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the failure using Snort 3.1.84.0-r4 on ARM64 OpenWrt SNAPSHOT after installing the official rules with snort-rules. Inspect how the rules are installed and loaded; done means the official rules load without the reported unknown rule keyword: pcre errors.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100